Abstract:Recently data mining methods have gained importance in addressing network security issues, including network intrusion detection — a challenging task in network security. Intrusion detection systems aim to identify attacks with a high detection rate and a low false alarm rate. Classification-based data mining models for intrusion detection are often ineffective in dealing with dynamic changes in intrusion patterns and characteristics. Consequently, unsupervised learning methods have been given a closer look for network intrusion detection. We investigate multiple centroid-based unsupervised clustering algorithms for intrusion detection, and propose a simple yet effective self-labeling heuristic for detecting attack and normal clusters of network traffic audit data. The clustering algorithms investigated include, k-means, Mixture-Of-Spherical Gaussians, Self-Organizing Map, and Neural-Gas. The network traffic datasets provided by the DARPA 1998 offline intrusion detection project are used in our empirical investigation, which demonstrates the feasibility and promise of unsupervised learning methods for network intrusion detection. In addition, a comparative analysis shows the advantage of clustering-based methods over supervised classification techniques in identifying new or unseen attack types.

Intrusion Detection Based on Unsupervised Clustering Algorithm

Research and Implementation of Unsupervised Clustering-Based Intrusion Detection

Clustering Detection Algorithms for Network Intrusions

An Unsupervised Anomaly Intrusion Detection Algorithm Based on Swarm Intelligence

Unsupervised Anomaly Detection Based on Partition and Agglomerative Hierarchical Clustering

Research of the Intrusion Detection Based on Weighted Features Unsupervised Fuzzy Clustering

New Intrusion Detection Method Based on Unsupervised Learning

Intrusion Detection Based on Immune Clustering

CLUSTERING BASED ON SWARM INTELLIGENCE WITH APPLICATION TO ANOMALY INTRUSION DETECTION

An Anomaly Intrusion Detection Algorithm Based on Semi-Supervised Clustering

A Tabu Clustering Algorithm for Intrusion Detection

CLUSTERING-BASED NETWORK INTRUSION DETECTION

An Intrusion Detection Approach Based on Affinity Propagation Clustering

Multilayer Intrusion Detection System Based on Semi-supervised Clustering

A time stamped clustering method for intrusion detection

A Genetic Clustering Method for Intrusion Detection.

An Attribute-weighted Clustering Intrusion Detection Method.

A hybrid unsupervised clustering-based anomaly detection method

Intrusion Detection Based On Unsupervised Clustering And Simulated Annealing (Idcsa)

Intrusion Detection Based on Adaptive Polyclonal Clustering

ID-DC:Intrusion Detection Based on Distributed Clustering